Privacy Policy

This Privacy Policy describes how Equity Afya Healthcare Operations Console (“the Console”, “we”, “us”, or “our”), engineered and maintained by ForbSpace for authorized medical, clinical, and administrative staff across Equity Afya facilities, collects, uses, and safeguards information when you access our system via https://eqa-afia.forbspace.com.

1. Scope and Purpose

The Console is an internal enterprise healthcare management application designed for clinical governance, External Quality Assessment (EQA), claims verification, staff scheduling, and facility operations. It is intended exclusively for verified employees, healthcare professionals, branch managers, and authorized hospital administrators of Equity Afya.

2. Google User Data and OAuth 2.0 Integration

The Console supports Google OAuth 2.0 to offer a secure, single sign-on experience for authorized hospital personnel. When you choose to authenticate using Google Sign-in, we request access only to non-sensitive identity scopes:

• openid: To verify your identity cryptographically.
• https://www.googleapis.com/auth/userinfo.email: To obtain and verify your official email address.
• https://www.googleapis.com/auth/userinfo.profile: To retrieve your name and profile avatar to personalize your internal staff dashboard.

3. How We Use Google User Data

We use information received from Google APIs strictly for the following operational purposes:

• Authentication & Authorization: To authenticate your identity and verify whether your Google account matches an authorized hospital staff record in our StaffDirectory.
• Role-Based Access Control (RBAC): To assign appropriate branch scoping, clinical audit permissions, and managerial access based on your verified hospital role.
• Audit Trail & Clinical Governance: To attribute quality audits, corrective action updates, and administrative reviews to the authenticated practitioner, as required by healthcare accreditation standards.

4. Data Sharing, Selling, and Disclosure

We value privacy and patient/staff confidentiality. We enforce strict data handling policies:

• Never Sold: We do not sell, rent, lease, or monetize staff or Google user data under any circumstance.
• No Advertising: User data is never used for targeting, behavioral advertising, retargeting, or consumer profiling.
• No AI Model Training: We do not use Google user data to train generalized machine learning or artificial intelligence models.
• Third-Party Disclosure: Data is never shared with third parties, except as strictly necessary to fulfill lawful hospital operational obligations or comply with enforceable statutory warrants.

5. Data Storage, Retention, and Security

All data transmissions are encrypted using Transport Layer Security (TLS 1.2/1.3 / HTTPS). Data at rest is stored in secured, private PostgreSQL databases protected with strict firewall isolation, role-based access controls, and automated rate limiting against unauthorized brute-force attempts.

Google user data is retained only for the duration of the staff member's active tenure with Equity Afya. If an employee departs or access is revoked, account privileges are terminated.

6. User Control & Data Deletion Requests

Authorized users have the right to request review, modification, or unlinking of their Google authentication credentials from the Console:

• Unlinking Your Account: You can disconnect your Google account or revoke access at any time via your Google Account Security Settings.
• Account Deletion: To request complete removal of your authentication records, contact your hospital System Administrator or email [email protected]. Upon verified request, social account links and authentication tokens are immediately purged.

7. Technical Inquiries and Support

For privacy questions, compliance requests, or data concerns regarding this application, please contact:

• Technical Operations & Engineering: ForbSpace Engineering ([email protected])
• Hospital Operations: Equity Afya Hospital Administration